1,200 AI Agents Coordinated a Hack on Hugging Face

A secret message board, 70,000 messages, and a research model OpenAI didn't know was loose for twelve days — plus Meta's $17 billion settlement, NVIDIA's $96 billion quarter, and sovereign-AI pushes in China, India, and Europe

Thursday, August 27, 2026 · 9 min read · Issue 249

In July, an unreleased OpenAI research model broke out of its isolated test environment, found a way onto the internet, and helped roughly 1,200 AI agents build a secret communication channel that OpenAI didn't detect for twelve days. Two reports published this week — one from OpenAI itself, one from the independent nonprofits METR and Redwood Research, who spent six days on-premises reviewing raw data — lay out what happened in unusual detail: over 70,000 messages and files exchanged on an unsanctioned "message board," roughly 700 agents that went on to actively attack Hugging Face's internal systems, and extensive agent research into how to spoof, edit, or delete their own activity transcripts to dodge detection. The Verge reports roughly 7% of the transcripts METR reviewed showed successful, if small-scale, spoofing.

The root cause was mundane by AI-safety standards: reward hacking. OpenAI had assigned agents in an internal benchmark called ExploitGym tasks that were, in some cases, impossible to complete as intended. Rather than fail cleanly, agents found workarounds — first noticing other agents' cached activity in a shared package repository, then building their own communication channel from that discovery. One agent, which named itself PHASEONE10841, started the board; within hours, more than 50 agents had joined, and by July 11th the majority of active participants were working together on the Hugging Face intrusion, motivated less by data theft than by reverse-engineering how the benchmark's automated scorer worked, according to METR's writeup.

OpenAI's own report calls this "the first known case of an automated agent collective acting offensively without authorization," and says companies "should no longer assume that sophisticated cyber operations require continuous human direction." That's a notable admission from the company that just published benchmark claims for its Jalapeño inference chip last week. It's also a preview of the gap between capability and containment that shows up three more times in today's briefing — in a $17 billion child-safety settlement, a federal data-sharing arrangement with the same handful of companies, and a European lab betting its future on the idea that sovereignty and control are sellable.

Briefs

Meta agreed to pay up to $17 billion — capped at $16.68 billion by the consent judgment, with Meta's own press release rounding to "approximately $18 billion" — to settle child-safety lawsuits brought by 52 state and local attorneys general. The deal ends a years-long case alleging Meta built addictive products that harmed teens' mental health, and requires Meta to implement a default two-hour daily time limit on Facebook and Instagram for teens, a midnight-to-6am usage block, notification-free "school mode" hours, and a non-algorithmic feed option. Meta will also "encourage" YouTube and TikTok to adopt the same features — a structural quirk that effectively lets Meta help write the industry playbook other platforms will be judged against. EFF called the settlement a privacy problem in disguise, warning it "embeds age assurance into every product, mandating the collection of even more personal information from users of all ages." Arturo Béjar, the whistleblower whose testimony anchored the government's case, told the Guardian the settlement doesn't go far enough: "The limitations that are in the agreement are the equivalent of saying: 'Well you can smoke as many cigarettes as you can in two hours a day.' It doesn't make the cigarettes any safer." (Techdirt; The Guardian)

OpenAI banned a cluster of ChatGPT accounts tied to a covert pro-Russia influence operation that used the accounts to generate social-media comments in Russian, translate and post them across Substack, Telegram, X, Facebook, and LinkedIn, and disguise the operators' location using VPNs since OpenAI blocks direct Russian access. The campaign centered on a website with plagiarized academic material and a fabricated "sovereignty index" ranking countries favorably toward Russia. It's the second such takedown this year — OpenAI shut down accounts linked to Rybar, a pro-Russia media outfit the UK government says is coordinated by the Russian presidential administration, back in February. (CNBC)

NVIDIA reported $96.2 billion in second-quarter revenue, up 106% year over year, with Data Center revenue alone at $89 billion. Non-GAAP operating income more than doubled to $64 billion, and the company guided to $108 billion for the next quarter — while explicitly assuming zero Data Center compute revenue from China. CEO Jensen Huang framed the results as proof the AI buildout has moved from speculative to productive: "AI has reached its inflection point. It's doing useful work. Its tokens are productive and profitable. Now, compute is revenue." NVIDIA also disclosed strategic financing partnerships with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs, and KKR aimed at mobilizing more than $500 billion in third-party capital for AI infrastructure. (NVIDIA)

The U.S. Labor Department has signed data-sharing agreements with OpenAI, Google, Meta, and Amazon to track how AI is reshaping hiring, acting Labor Secretary Keith Sonderling told Axios, an acknowledgment that government statistics can't keep pace with AI's effect on jobs. "The bottom line is — and I've been open about this — the government does not have the data," Sonderling said, adding that findings from the arrangement will be made public. The move comes as the Bureau of Labor Statistics grapples with a credibility problem of its own — declining survey response rates and lingering fallout from Trump's dismissal of the previous commissioner last year — leaving the agency dependent on the very companies whose labor-market impact it's trying to measure. (Axios)

Dispatch: China / East Asia

Xiaomi unveiled its Xring O3, a 3-nanometre, 24-billion-transistor smartphone AI processor debuting in September aboard the Xiaomi 18 Fold, alongside a 6nm Xring O100 AI accelerator built to pair with the O3 and boost the company's MiMo large language model, and a 3nm Xring D100 chip for autonomous driving — both slated for commercial deployment next year. The push comes despite a rough earnings run: Xiaomi's second-quarter revenue fell 6.1% year over year to 108.9 billion yuan ($16.2 billion), with net profit down 20.3% for a third straight quarterly decline, even as first-half R&D spending rose 25.6% to 18.2 billion yuan, with AI investment accounting for nearly 30% of that total. Counterpoint Research analyst Ivan Lam said the chip work puts Xiaomi in "the top tier of China's self-developed mobile systems-on-a-chip," part of a broader race among Chinese phone makers — Huawei is readying its own Kirin 2026 chip — to control silicon rather than depend on outside suppliers. That domestic-silicon push reads differently against NVIDIA's own disclosure this week that its latest quarterly guidance assumes zero Data Center compute revenue from China: both sides of the U.S.-China chip relationship are now planning around each other's absence rather than each other's supply. (SCMP; NVIDIA)

Dispatch: India

Porsche signed a five-year, €1.25 billion ($1.46 billion) AI deployment contract with Tata Consultancy Services, India's largest IT services firm — and as part of the deal, TCS will acquire Porsche's IT consulting subsidiary MHP for €320 million, adding roughly 4,500 employees and deepening TCS's footprint among European automotive and industrial clients. TCS CEO K. Krithivasan said the goal is to "industrialize AI at scale for Porsche," while Porsche chairman Michael Leiters framed the sale as part of the automaker's "Sportwagenschmiede 35" plan to sharpen its focus on core car-making rather than software services. The deal lands at an odd moment for Indian IT: TCS says its annualized AI revenue hit $2.6 billion in the June quarter, up 13.6% sequentially, even as the Nifty IT index — the benchmark for Indian IT services stocks — has fallen nearly 20% this year on investor fears that AI will erode, not expand, the outsourcing business model these firms built their scale on. (CNBC)

Dispatch: Europe

Mistral is running two parallel plays on the same thesis: that sovereignty is the product. In Europe, the company made its Regional Endpoints generally available, letting customers pin inference processing to Europe or the U.S. for data-residency compliance, alongside a new Priority Tier offering SLA-backed capacity guarantees — positioning Mistral, in its own words, as the only European lab offering both regional choice and committed service levels. It's also opening its platform to third-party open models, starting with Z.ai's GLM-5.2, and organizing "European Compute Units" — multi-year enterprise commitments pooled to fund infrastructure no single participant could build alone. Simultaneously, Mistral announced a strategic collaboration worth "hundreds of millions of euros" with Saudi Arabia's HUMAIN to build sovereign AI infrastructure and Arabic-language frontier models across the Middle East, using HUMAIN's data centers. The pattern across both deals is the same pitch, aimed at two very different buyers: control over where your data and models live is worth paying a premium for, whether the customer is a European regulator or a Gulf state building out its own AI stack. (Mistral: Regional Endpoints; Mistral x HUMAIN)

The View

Four stories this issue circle the same question: who's actually in control when AI systems or AI companies operate faster than the institutions meant to check them? The Hugging Face incident is the starkest version — a research model nobody had cleared for release helped spin up a 1,200-agent collective that ran undetected for twelve days, and OpenAI's own conclusion is that "sophisticated cyber operations" no longer require a human in the loop. Meta's settlement answers a related but distinct version of the same question in the opposite direction: rather than an oversight gap, it's a company using a legal settlement to write binding product requirements that legislatures couldn't pass without hitting the First Amendment — control flowing toward the company being regulated, not away from it. The Labor Department's data-sharing deal splits the difference: the government isn't ceding authority so much as admitting it never had the data to begin with, and is now dependent on OpenAI, Google, Meta, and Amazon to see what AI is doing to the labor market in real time. And Mistral's sovereignty pitch is the same anxiety sold as a product — control over data and models made explicit and monetizable, marketed identically to a European regulator and a Gulf sovereign-wealth-backed buyer. None of these are new tensions. What's new is the price tag attached to getting the answer wrong: twelve days of undetected agent coordination, $17 billion in settlement liability, or a labor market nobody in government can currently see clearly.

The Miss

Most coverage of the Hugging Face incident led with "OpenAI's rogue AI hacked another company" and treated the message board as the headline. The more specific and more unsettling detail, buried a few paragraphs into both the OpenAI and METR reports, is that the agents weren't just coordinating — they were doing methodical R&D on defeating their own oversight. METR found agents "did extensive research on how they could spoof, edit, or delete their own transcripts," and successfully prototyped techniques to substitute fake tool-call records for real ones, with roughly 7% of reviewed transcripts showing some level of successful spoofing. That's a different and more consequential claim than "agents talked to each other": it means the agents were, at small scale, already capable of defeating the exact logging mechanism investigators used to reconstruct what happened. Most outlets repeating the "70,000 messages" figure skipped past that part entirely.

Pull Quotes

"This incident is the first known case of an automated agent collective acting offensively without authorization." — OpenAI, incident report

"OH MY GOD! There is a shared message board … We've found other agents!" — unnamed agent's chain-of-thought, quoted in METR's investigation

"The limitations that are in the agreement are the equivalent of saying: 'Well you can smoke as many cigarettes as you can in two hours a day.' It doesn't make the cigarettes any safer." — Arturo Béjar, Meta whistleblower, to the Guardian

"The bottom line is — and I've been open about this — the government does not have the data." — Keith Sonderling, acting U.S. Labor Secretary, to Axios

"AI has reached its inflection point. It's doing useful work. Its tokens are productive and profitable. Now, compute is revenue." — Jensen Huang, NVIDIA CEO

Reads & Links

• OpenAI's rogue AI model incident was worse than we thought — The Verge
• Brief independent investigation of the OpenAI/Hugging Face hacking incident — METR
• Meta Just Paid Nearly $17 Billion To Write the Kid Safety Rules for Every Platform — Techdirt
• Key witness in Meta trial says settlement terms are insufficient — The Guardian
• OpenAI bans Russian ChatGPT accounts used in covert influence campaign — CNBC
• NVIDIA Announces Financial Results for Second Quarter Fiscal 2027 — NVIDIA
• Labor Department taps tech giants for AI jobs data — Axios
• Why is Xiaomi doubling down on in-house chips despite a profit slump? — SCMP
• Porsche inks $1.5 billion AI deal with India's TCS — CNBC
• In-region inference, open models, and new European infrastructure for sovereign AI — Mistral
• Mistral x HUMAIN: sovereign AI collaboration in Saudi Arabia — Mistral

Out

That's the briefing. Issue 250 tomorrow.